Public key cryptography has been commonly used to provide a mechanism to support access control and general authentication services in distributed environments. For example, in networks storing confidential information, conventional systems typically employ access control to limit access to the confidential information to designated parties. These systems may additionally employ general authentication services to authenticate users of various network resources to ensure that originators and recipients of messages are actually the parties they claim to be.
Conventional public key cryptography relies upon public key certificates, such as those defined in ITU X.509, to bind a user's public key reliably to his name and provide users with the high level of assurance desired when identifying other entities. A certificate may be signed using a private key associated with the sender. The recipient of the message can then verify that the message was actually sent by the originator named in the message, provided that the recipient verifies the signature using the sender's public key.
In conventional systems, the responsibility for generating digital signatures and verifying digital signatures is borne by an application program executing on a general-purpose computer, under the control of a general-purpose operating system. For example, a conventional application program running on a computer in a network may have to authenticate link and network control messages. Similarly, the application program may have to encrypt messages using various encryption algorithms before transmitting these messages to other nodes in the network. Such tasks require an application programmer or network developer to acquire detailed knowledge of complex secret and public key algorithms and then develop programs to perform the required cryptographic functions.
Additionally, these cryptographic-related functions may require a network entity to exchange a number of messages with corresponding network entities when establishing a security association (SA). Such exchanges of messages consume very large amounts of network bandwidth, which is often limited in wireless systems.
As a result, there exists a need for a mechanism designed to avoid the requirement for an applications or network developer from having to acquire detailed knowledge of secret and public key algorithms. There is also a need for a mechanism that integrates cryptographic-related functions into a simple to use service set, thereby simplifying the developer's task regarding inclusion of strong security features in application and infrastructure programs.